Malware

Should I remove “Malware.AI.654307987”?

Malware Removal

The Malware.AI.654307987 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Malware.AI.654307987 virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Creates RWX memory
  • CAPE extracted potentially suspicious content
  • The binary likely contains encrypted or compressed data.
  • Creates an autorun.inf file
  • Authenticode signature is invalid
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics

How to determine Malware.AI.654307987?


File Info:

name: 5CE6850F8F1D89A4F43A.mlw
path: /opt/CAPEv2/storage/binaries/47329506f21aeb75977a5da54c372d522323b9bb45fca97ee93fbfa6d11c379c
crc32: 6DAEEE8B
md5: 5ce6850f8f1d89a4f43acf381fd1a3a6
sha1: 20247a12f724bf0296da8c0cf7cd36f96e861221
sha256: 47329506f21aeb75977a5da54c372d522323b9bb45fca97ee93fbfa6d11c379c
sha512: 4ec7a685dc18a7dcd44d06dbfc5b7c06770c4a2b8b649cd621626bd747fe6c0eefa2858906586d13d72c2680d32a86cf83c3d6d552c31af47c31b0b3968e6198
ssdeep: 3072:pD6OcKBTQNXDi/szVRTcmjVP320pycIDDQ190tJTjlpvc2G1WwuTI5wEl4YC76:Z6Q9Q1DPzTomB320oBDDA9wJ/vcNDj4M
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T146049DA2C213B4DCF756467D7C00C3560C969EA6E19197C0B8B12F8D83E252F8A6BF5D
sha3_384: f814d78eef85295fe29bc1ede4886ab5013668b51a3b0772e8ed1874cc392de0c65419ec50e8f59c25172a97658c1d08
ep_bytes: 6a40680010000068a08601006a00ff15
timestamp: 2012-09-05 20:26:28

Version Info:

0: [No Data]

Malware.AI.654307987 also known as:

BkavW32.AIDetect.malware1
LionicWorm.Win32.AutoRun.o!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Downloader.126
FireEyeGeneric.mg.5ce6850f8f1d89a4
McAfeeGenericRXAA-AA!5CE6850F8F1D
CylanceUnsafe
ZillyaWorm.AutoRun.Win32.198372
SangforSuspicious.Win32.Save.a
K7AntiVirusEmailWorm ( 0052ca6a1 )
K7GWEmailWorm ( 0052ca6a1 )
Cybereasonmalicious.f8f1d8
BitDefenderThetaAI:Packer.10D9AA541E
CyrenW32/Kryptik.AJG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/AutoRun.Agent.AFG
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Worm.Win32.AutoRun.pef
BitDefenderGen:Variant.Downloader.126
AvastWin32:WormX-gen [Wrm]
TencentWorm.Win32.AutoRun.ha
Ad-AwareGen:Variant.Downloader.126
SophosML/PE-A + Troj/Agent-BCGS
ComodoEmailWorm.Win32.AutoRun.KA@719dtc
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebWin32.HLLW.Autoruner3.499
TrendMicroTROJ_GEN.R002C0RL321
McAfee-GW-EditionBehavesLike.Win32.Generic.cc
EmsisoftGen:Variant.Downloader.126 (B)
SentinelOneStatic AI – Malicious PE
GDataGen:Variant.Downloader.126
JiangminWorm.AutoRun.bcss
Antiy-AVLTrojan/Generic.ASBOL.C6BE
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
AhnLab-V3Malware/Win32.RL_Generic.R295338
Acronissuspicious
VBA32BScope.Worm.Autorun
ALYacGen:Variant.Downloader.126
MAXmalware (ai score=85)
MalwarebytesMalware.AI.654307987
TrendMicro-HouseCallTROJ_GEN.R002C0RL321
RisingWorm.Autorun!1.AFBF (CLASSIC)
YandexTrojan.GenAsa!6D0EeHKQIts
IkarusVirus.Win32.Heur
eGambitUnsafe.AI_Score_99%
FortinetW32/Agent.AFG!tr
AVGWin32:WormX-gen [Wrm]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (W)

How to remove Malware.AI.654307987?

Malware.AI.654307987 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment